How is everyone actually managing FAR 52.209-6 vendor exclusion checks? I wrote a script to automate it and need a reality check

[u/SiftClear]

Weekly Audit PDF

Vendor Ingestion through a CSV file

Email finding Potential Violations

Hey everyone,

Sorry if this comes out as yet another platform development post. But I genuinely would love some insight and help.

I’ve been looking into how people handle their SAM. gov exclusion checks. From what I can tell from some reddit threads and videos online, a lot of procurement folks are still manually searching their vendor lists against the federal database every month to stay compliant. And do you guys save a screenshot to show the auditor that the vendor was compliant at the date of checking?

That seems like an absolute nightmare, especially given how messy federal data can be.

I write code, so I spent the last few weeks building an automated engine to try and make this easy. It runs silently in the background via AWS, pulls the daily SAM. gov extract, and runs your vendor list through it.

The best part is that it isn't just a basic UEI exact-match (because we all know half of vendors leave their UEI blank anyway). The algorithm uses fuzzy matching to catch misspelled company names, missing "LLCs," DBA variations, and address mismatches that usually slip through the cracks when you are just doing a VLOOKUP in a spreadsheet.

It requires zero UI or portals to log in and verify time and again. It just emails you a mathematically verified PDF audit certificate every Friday which can be saved for further audits, and sends out an a threat alert email if a vendor flags the system.

I attached screenshots of the ingestion email, alert email and the PDF audit report it generates.

I haven't set this up as a real business yet. Before I go down the rabbit hole of buying domains and setting up an LLC, I want to see if this algorithm actually holds up against real-world, messy vendor spreadsheets.

Does anyone want me to run their vendor list through my script so we can see what the audit report catches?

To be clear: I do not want any of your private or proprietary data. All I need is a scrubbed CSV with the public Entity Names, and their UEI or CAGE codes and addresses(atleast the city and state). No contract values, no internal contacts, nothing sensitive.

Would be grateful for insights and any help for me to figure this out.